PT-2026-25437 · Npm · Openclaw

Published 2026-03-03 · Updated 2026-03-03

OSV

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

The tar.bz2 installer path in src/agents/skills-install-download.ts used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.

This allowed crafted .tar.bz2 archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.

Affected Packages / Versions

• Package: openclaw (npm)
• Latest published at triage time: 2026.3.1
• Affected range: <= 2026.3.1
• Patched in: 2026.3.2 (released)

Impact

Local DoS / availability impact when processing untrusted .tar.bz2 skill archives.

Fix Commit(s)

• 0dbb92dd2bcf9a32379d11c0f11ed016669dae3e

Related advisories

• Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8
• Duplicate variant (closed): GHSA-rgr7-g85h-6v82

Fix

Resource Exhaustion

Weakness Enumeration

CWE-409

CWE-400

Related Identifiers

GHSA-77HF-7FQF-F227

Affected Products

Openclaw

References · 4

• https://osv.dev/vulnerability/GHSA-77hf-7fqf-f227 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227 · Note
• https://github.com/openclaw/openclaw/commit/0dbb92dd2bcf9a32379d11c0f11ed016669dae3e · Note